Zephyr v2.5.0

Mihomo desktop client · Tauri 2 + Rust

Goes everywhere.Leaks nothing.

Zephyr is a Mihomo desktop client built on Tauri 2 and Rust.

Release
v2.5.0
Platforms
Windows · macOS · Linuxx64 · ARM64
License
MIT, open sourceFree to use, code in the open
Download
下载 macOS 版Full · Lite · Minisign

01Live

Zephyr’s own frontend · demo backend · 1082 × 691

This is Zephyr itself.

Not a recording, not a render. This is Zephyr’s frontend source running in your browser, with demo data standing in for the Rust backend. Scroll and it operates itself — or take the controls and try it.

  1. System proxy, in one click.

    The switch is ownership-marked. If another app turns it off, Zephyr puts it back within 10 seconds.

  2. Rule. Global. Direct.

    Three outbound modes, one click apart on the console.

  3. TUN: the whole machine, through Zephyr.

    dns-hijack for UDP and TCP is filled in when TUN turns on, so DNS doesn’t leak.

  4. Fourteen languages.

    Arabic, Persian and Urdu mirror the entire layout right-to-left.

  5. Dark, with the same care.

    Follows the system, or switch by hand.

  6. Just want a glance?

    The minimal home keeps the status and the switches. One setting brings the console back.

02Size

Read live from GitHub Releases · v2.5.0

That’s the entire Windows installer.

Tauri 2 draws the interface with the WebView your system already has, so there’s no browser to ship, and the Rust backend does only what it must. Lite leaves the core out; Full bundles the Mihomo core and Geo data, ready to go.

Zephyr_2.5.0_windows-x86_64-setup-lite.exe

FIG. 2.1Main installer per platform, in MBLite Full
0
frontend framework dependenciesThe UI is written in plain JavaScript — no React, no Vue
104
native ES modulesThe whole frontend, apps/desktop/src
6
platform buildsWindows · macOS · Linux, x64 and ARM64
14
interface languagesThree of them right-to-left

03Security

13 layers of defense in depth · see the wiki Security architecture →

Trust nothing by default.

Subscriptions, links, rules, scripts: everything that enters Zephyr is treated as untrusted. It has to travel the path below, and wherever safety can’t be confirmed, it stops right there. Thirteen layers, each independent, so one failure never takes the rest down.

FIG. 3.1How a subscription travels from input to the core (L = layer)→

Minisign + SHA-256
Every installer ships with a .minisig signature. Client updates must pass both checks; a failed core swap rolls back on its own.
SignPath
Windows installers and the portable build are signed with a SignPath Foundation certificate, each one verified before it replaces the unsigned file.
CycloneDX SBOM
Every release publishes a complete software bill of materials.
Always scanning
14 security jobs in security.yml, plus CodeQL, Snyk, GitGuardian, Semgrep, cargo-deny, TruffleHog and OSSF Scorecard.

04Details

Every screen below is a real capture · v2.5.0

Look closer.

Zephyr proxies page after a latency test 1 2 3

04.1 · Proxies

Nodes are remembered.

Node scoring keeps track of each node’s latency and stability, and scheduled tests refresh the scores in the background. When the current node keeps failing, failover moves to the best candidate. Three switches, each independent.

  1. 1Current node. Latency is colored in four bands: < 200, 200–500, ≥ 500 ms and timeout
  2. 2One click tests every node by real round-trip time
  3. 3When the test ends you get the count of live nodes and the fastest one

04.2 · Prism

Rewrite a subscription without touching it.

The Prism engine rewrites subscriptions with declarative YAML: scope by subscription, platform or Wi-Fi, prepend or append rules, override DNS. Anything trickier goes to a QuickJS sandbox script, with limits on run time, memory, loops and recursion depth.

  • $prepend
  • $append
  • $override
  • $default
  • $filter
  • $transform
  • $remove

Prism engine docs

The Prism override editor, completing as you type 1 2
  1. 1CodeMirror 6 editor with context-aware completion
  2. 2Pre-flight check before saving; overrides go through the same dangerous-key sanitizer

04.3 · Connections & logs

Every connection has an origin.

The connections page lists each connection with its process, the rule it matched and the full chain. Logs put app and core output under one filter bar, with pause, jump-to-latest and search highlighting.

Connections page
FIG. 4.3a — Connections: process · rule · chain
Logs page
FIG. 4.3b — Logs: the core’s own output

04.4 · Languages

Fourteen languages, one “Settings”.

Each line on the right is Zephyr’s own label for “Settings”, taken straight from the app’s language files. For right-to-left languages, the whole interface mirrors with it.

    04.5

    Tech specs

    TUN privileges
    Windows relaunches as admin through UAC; on macOS only the core runs as root; Linux uses pkexec, setcap and polkit. Requested only when you turn it on.
    DNS leak protection
    With TUN on, both any:53 and tcp://any:53 dns-hijack entries are ensured — applied through the core API only, never written to your profile.
    System proxy guard
    Ownership-marked; re-applied every 10 seconds if something else turns it off, and recoverable after a crash.
    Subscription download
    Never through the system proxy. In order: direct with DNS pinning; through the core’s mixed port; a temporary switch to global mode, restored afterwards.
    Rule library
    Enable, disable and import rule files; sanitized before saving, and malformed YAML is refused. The insert form covers 12 rule types: DOMAIN-SUFFIX · DOMAIN · DOMAIN-KEYWORD · GEOSITE · IP-CIDR · IP-CIDR6 · GEOIP · PROCESS-NAME · DST-PORT · SRC-IP-CIDR · RULE-SET · MATCH
    Process icons
    Connections show each app’s own icon: Windows executables, macOS .app bundles, Linux .desktop entries.
    Traffic chart
    Drawn with native Canvas 2D, no chart library; reconnects on its own when the stream drops.
    Keyboard & accessibility
    Roving tabindex in node lists, focus traps in dialogs, focus rings only when you use the keyboard.
    Appearance
    4 preset accents or any custom color; window opacity; 100–150% interface scaling.
    Portable & links
    Portable builds for Windows and Linux; a clash://install-config link asks you to confirm before it imports.

    05Download

    v2.5.0 · · every file has a Minisign signature

    为你的电脑准备好了。

    Full bundles the Mihomo core and Geo data; with Lite you supply the core yourself. If unsure, take Full.

    Installation guide

    Package managers

    Wingetwinget install Juwan.Zephyr
    Scoopscoop bucket add zephyr https://github.com/Juwan-Hwang/scoop-bucket
    scoop install zephyr
    AURyay -S zephyr-clash-bin

    —Credits

    40 contributors · 724 stars · 39 forks · MIT

    Made in the open.

    Code, builds and signing are all public. Below are all 40 contributors GitHub counts — the people who worked on Zephyr, and the automated programs that write, review, scan and maintain it — taken from the commit authors and co-authors on main.

    Star it on GitHubContributing guide

    Zephyr

    Secure first · Minimal by design · Light by nature

    下载Read the docs